22 May 2020
The Privacy community in Turkey is currently focusing on the fine imposed by the Turkish Data Protection Board (“TDPB”), against Amazon Turkey amounting to EUR 160,000. Although it is the 4th highest fine issued by the TDPB until to date, it is a landmark decision as it addresses international data transfers and electronic commercial communication. We are currently working on a detailed review.
Briefly, these are the highlights from the TDPB’s decision:
The decision is landmark decision but at the same time raise some concerns:
The Amazon Turkey Decision suggests that:
Although there may be ambiguities on the powers of different authorities to decide on complaints regarding electronic commercial communications, the Amazon Turkey Decision correctly addresses the importance of adopting opt-in mechanisms and not relying on opt-out. This has been the established practice in Turkey for a long time and must be obeyed carefully by all controllers.
Generic consents simply added to the privacy notices are not valid and lawful. Consents must be taken latest at the time of processing/transmission not later.
According to the TDPB, in relation to the data transfers to third parties residing abroad, controllers do not have any option but rely on explicit consent, given the circumstances (ie in the absence of list of adequate countries or an approval from the TDPB). The Amazon Turkey Decision suggests that if the controllers apply to the TDPB for the approval of their transfers to abroad by signing commitments, they must either rely on explicit consents of the data subjects for any transfers made or being made until that date (ie until their application date) or keep all data locally (ie not commence any transfers abroad without obtaining the approval TDPB).
As a final note, we would like to remind you that the TDPB only issued a summary of the Amazon Turkey Decision on its website. Thus, the foregoing is based on our review of that summary decision. We did not have the chance to see the TDPB’s decision in its entirety. We hope that more guidance and clarification will follow in the upcoming days on the implications of this decision.
Data Privacy Blog